What happened
On January 13, 2018, BlackWallet's blackwallet.co domain was hijacked and visitors were redirected to attacker-controlled infrastructure. The malicious version of the site used JavaScript to redirect Stellar lumen payments from affected wallet users to an attacker wallet. Contemporaneous reports tracked nearly 670,000 XLM, worth roughly $400,000 to $444,000 at the time.
BlackWallet's creator said that a hosting-provider account had been compromised, but later DNS analysis could confirm the name-server change rather than the precise method used to obtain account access.
How it happened
- Attackers altered the DNS delegation for blackwallet.co on January 13, pointing the domain to attacker-controlled name servers.
- Wallet users who visited the normal BlackWallet URL were therefore sent to the attackers' version of the service.
- The malicious site served JavaScript that redirected lumen transfers or deposits of at least 20 XLM to an attacker-controlled Stellar wallet.
- The domain was restored after several hours, but contemporary reporting found that the attacker had already moved most of the stolen lumens from the receiving wallet.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
